1. Field of the Invention
This invention relates to virus detection and protection systems and more particularly to a method and system for reducing the scan time required for detection of viruses.
2. Description of the Related Art
Among all computing and networking security issues, the most important cause of concern does not come from intrusions, but from the widespread proliferation of viruses. Viral infections represent the great majority of all security incidents and consume massive amounts of time and resources in their detection and in correcting problems associated with the execution of undetected viruses on a system.
In their most basic form, viruses and other unwanted programming instructions manifest themselves in unwanted code and/or programs inserted into files that executed on a computer system. The various manners in which such unwanted instructions are copied into computer systems are well known and are thus not discussed further herein.
To combat the problem of viruses and other unwanted code finding their way onto and executing on computer systems, virus scan programs have been developed to identify the existence of viruses on a system. As is well known, virus scan programs function essentially as follows. Each file on a computer system is scanned and a check sum or hash value (or simply “hash”) is created for each file. A hash, also called a message digest, is a number generated from a string of text. The hash is substantially smaller than the text itself, and is generated by a formula in such a way that is extremely unlikely that some other text will produce the same hash value. Hashes play a role in security systems where they are used to ensure that transmitted messages have not been tampered with. The sender generates a hash of the message, encrypts it, and sends it with the message itself. The recipient then decrypts both the message and the hash, produces another hash from the received message, and compares the two hashes. If they are the same, there is a high probability that the message was transmitted intact. The concept of hashing is well known and is not discussed further herein.
The file name and the hash value are compared to a virus signature file which contains information regarding all known viruses as of the date the virus scan program was last updated. If a match is found (i.e., if the file name, or elements of the file itself (it's hash matches a known virus hash), correspond to the name or elements of a known virus), the file containing the match is quarantined and rendered inoperable, repaired, or deleted. The virus signature files are updated periodically, e.g., weekly or more frequently if needed as new virus files are discovered. This requires users to run a complete virus scan on all files each time the virus signature files are updated.
Virus scan programs take a long time to perform their scanning and checking process. For each 10 Gigabytes of memory, it can take approximately 30 minutes to complete a scan and check operation. As the size of hard drives increase, and with the increase in size of software images due to multimedia content, such as MP3 and digital pictures, the problem of increased scan time is only getting worse. The scanning operation itself uses significant system resources and thus delays other operations that a user is attempting to perform. Further, with the proliferation of mobile laptop devices, it is often impossible to schedule virus scans during off hours, as can be done with desktop systems that are never turned off, since laptop systems are typically turned off when not in operation.
Accordingly, it would be desirable to have a system and method for decreasing the time required to perform virus scan operations using virus scan programs.